S 3.8 Avoidance of factors impairing the organisation climate

Initiation responsibility: Personnel/Supervisory Board, Top Management, Head of Personnel

Implementation responsibility: Personnel/Supervisory Board, Supervisor, Personnel Department

On the one hand, a positive work climate motivates the employees to maintain the security safeguards, and on the other hand, it reduces the risk of negligent or deliberate acts that may disrupt operations. Problems regarding the working climate may have a number of internal and external causes, but frequently arise in the event of extensive changes within the organisation. Examples of such changes include restructuring, downsizing, the sale of the company, mergers of organisational units, and outsourcing projects. These may adversely affect the work climate, because they usually provoke various types of anxiety (for example a loss of authority, fear of failure, or fear of job loss). It is easier to assuage these anxieties if the work climate was good before the changes are made.

Also for security reasons, the organisation should attempt to achieve and permanently maintain a positive work climate. It is impossible to list the numerous ways to accomplish this, which is why this document only provides a selection of possible safeguards, with their appropriateness and feasibility having to be examined individually:

• setting up a social room,
• avoiding overtime,
• avoiding large amounts of residual holiday leave,
• maintaining break times,
• proper distribution of tasks,
• evenly distributed workloads,
• performance-based pay,
• having substitution arrangements in place.

Communication problems in an organisation almost inevitably lead to security problems as well. In extreme cases, this may result in deliberate violations of the security policies. If the users only perceive the security safeguards as a "burden" because they have not been informed of their purpose, then they may bypass or avoid implementing these safeguards.

It must also be possible to be the bearer of bad news without having to fear sanctions. The existing work climate should allow any person concerned to report security incidents in their own company and/or government agency. This is the only way to effectively and openly deal with any security deficits present.

The employees' motivation cannot only be increased by financial incentives. It is first and foremost important to acknowledge their performance. Employees should be involved in decision-making processes whenever possible.

At a minimum, they should be informed of the reasons behind the decisions made so that they are actively involved in their implementation and are motivated as well.

In many cases, users will protest against the selection of certain hardware or software by attempting to demonstrate that the hardware or software they are forced to use is not as secure as the hardware or software they would prefer to use.

The work climate and the conduct of the employees may be particularly important when making extensive changes, as is the case with outsourcing projects, for example: dissatisfied or upset employees may cause such projects to be doomed to fail (for example when employees with expert knowledge quit during critical phases of the change or deliberately ignore security instructions), which may threaten the existence of the company as a result. When making large-scale changes to the structure of the organisation or when planning outsourcing projects, it is recommended to consider the following aspects:

• The employees should be involved early-on in the decision-making processes, for example in the selection of the outsourcing service provider. In the further course of the project, they should also be involved in the process of drawing up any takeover agreements.
• The employees should be informed in due time and in full of changes and have a contact person for problems and questions. Information obtained indirectly from the media, for example from the newspaper, instead of directly from the Top Management of the company or government agency creates mistrust, destroys the basis of trust, and paves the way for widespread speculation and rumours.
• When making organisational changes, the employees affected by the changes should be offered perspectives for the future. In many cases, outsourcing service providers depend on having as many employees as possible from the department to be outsourced work for them. This is the only way to guarantee a satisfactory quality of service. The quality of the work done by employees who are worried about their future or feel they have been treated unfairly may suffer, or such employees may even leave the company prematurely.
• Complex or stressful tasks that cannot be avoided when restructuring an organisation should be adequately recognised and appreciated. The extra work required should be compensated monetarily.

Review questions:

• Is the work climate described as positive both by the employees and by the supervisors?
• Are the factors adversely affecting the work climate eliminated promptly?
• When restructuring an organisation on a large scale, is there someone responsible for being available to the affected employees as a contact person?
• Are the employees involved in change processes?